Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Microsoft Defender Security Research Team and Microsoft Threat Intelligence documented a campaign in which Storm-2949 abused Microsoft Entra ID accounts to exfiltrate data from Microsoft 365 and Azure environments. The attack shows how cloud intrusions increasingly unfold through identity systems, administrative features, and legitimate platform capabilities rather than obvious malware or traditional endpoint compromise.

Monitoring milestone highlights shift toward real-time transaction intelligence as financial institutions face escalating fraud and operational risk VANCOUVER, B.C. — May 21, 2026 — INETCO, a global leader in real-time payment fraud prevention, today announced the monitoring of more than 100 billion transactions per year, empowering financial institutions and payment service providers across more than 30 countries to outsmart fraudsters, stay compliant and keep every customer safe.

In a significant security incident unfolding on May 20, 2026, GitHub confirmed unauthorized access to its internal repositories. The breach involved the exfiltration of sensitive internal source code and organizational data, reportedly totaling around 3,800 to 4,000 private repositories. A threat actor surfaced on underground forums advertising the stolen materials for sale, complete with directory listings of compressed archives and sample verification offers.

One of the most important shifts AI enables in detection engineering is changing where engineers spend their time. Traditionally, a significant portion of detection development effort is consumed by implementation details: writing complex SQL queries, building enrichment pipelines, handling edge cases, tuning rule logic, writing tests, documenting detections, and repeatedly iterating on detection logic. Those tasks are necessary, but they are also time-consuming.

Tatu Ylonen, the inventor of the SSH protocol, has long warned that a single stolen SSH key "can in many cases lead to compromise of the entire server environment." But in the bare-metal and private cloud infrastructure of high-frequency or quantitative trading firms, privileged access to trading infrastructure often depends on shared or static credentials like SSH keys or hardcoded API tokens.

The Musk vs. OpenAI trial has drawn a lot of attention over the past few weeks, but there’s a quieter legal development that matters more to most organizations. In February 2026, a federal judge in New York issued the first ruling in the country to directly answer whether conversations with a consumer AI tool can be protected by attorney-client privilege. The answer was no, and the reasoning behind it has implications that extend well beyond the courtroom where it was decided.

You’re most likely here because of some math and news about how to get that math and mess sorted. Your engineering team can’t manually pentest every release, your scanners flood Jira with noise, and your CISO needs audit-ready evidence by next quarter, and the autonomous pentesting market promises relief; AI agents that discover, chain, and exploit vulnerabilities at human-quality depth, in hours instead of weeks.

In 2012, the "Shadow IT" crisis was employees putting files in Dropbox for convenience. In 2026, the crisis is Shadow MCP. Instead of a simple file storage app, security teams are now facing unvetted AI agents with the power to read from and write to internal systems. These servers are often running on infrastructure that was never reviewed, never approved, and remains entirely invisible to governance.

CVE-2026-42945, nicknamed "NGINX Rift", is a heap buffer overflow in the ngx_http_rewrite_module component of NGINX. It has sat in the project's source code since 2008. F5 disclosed the flaw on May 13, 2026, after responsible disclosure by researchers at depthfirst, who reported finding it through an autonomous code scanning system.

CVE-2026-20182 is an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). The flaw sits in the peering authentication path of the vdaemon service running over DTLS on UDP port 12346, the same control-plane service involved in CVE-2026-20127 earlier in 2026. It is not a patch bypass of that earlier issue, but a separate weakness in the device-type handling of the control connection handshake.